Malware creators have managed to sneak malicious apps disguised as Adobe Flash installers through Apple’s app notarization process for the second time this year. App notarization is a security protection that Apple officially rolled out earlier this year. It’s a process that requires Mac app developers to submit their apps to Apple for a series of automated security scans that check for malware or other malicious code patterns .
Apps that pass the scans are rated “notarized,” which means they are added to a whitelist within Apple’s GateKeeper security service. Once added to GateKeeper’s whitelist, notarized apps can be opened and installed with a simple click, without any warnings or pop-ups. App notarization is mandatory for all apps that want to run on Apple’s latest macOS releases , including Catalina and Big Sur .
The notarization process was embraced by users and developers alike, as it removed some of the friction of installing apps on macOS. However, like Bouncer, the automated security system that scans Android before they're uploaded to the Google Play Store, Apple's app notarization process was never expected to be perfect.
The first malicious apps that managed to pass the notarization process and make it onto the whitelist of newer macOS versions were discovered in late August. In total, 40 apps infected with the Shlayer trojan and the BundleCore adware passed.
In a report published last week, Joshua Long, lead security analyst for security software maker Intego, said his company discovered six new apps that had passed the notarization process. Long told ZDNet that the six notarized apps were presented as Flash installers. Once installed, the apps download and install the adware OSX / MacOffers, which is known for modifying the search engine in a victim's browser.
It's unclear how Apple discovered this, but it's speculated that it may have received a warning from another malware researcher, or perhaps a Mac user who encountered the malicious activity.
As Adobe will retire Flash at the end of the year, Long urges users to stop downloading and installing Flash installers.
